Add CI Vulnerability And Coverage Signals

[TheSilkky]

Add CI Vulnerability And Coverage Signals

Priority

P3

Type

ci

Labels

Suggested GitHub labels:

• backlog
• ci
• testing
• security

Branch scope

• Current branch: develop
• Current HEAD: ac90683f697681e98f44e5020292adf31a588cda
• Target branch, if known: develop
• Reviewed branch/ref, if applicable: develop
• Reviewed commit SHA, if applicable: ac90683f697681e98f44e5020292adf31a588cda
• Target release/version, if applicable: v0.5.0 follow-up
• Scope classification: follow-up-after-merge
• Scope note: This draft is scoped to the develop branch after the technical-review branch was merged. Revalidate against the target branch before creating or closing public GitHub issues if the branch has moved.

Summary

The current CI workflow has useful test, build, and artifact provenance signals, but it does not publish coverage or run an explicit Go vulnerability scan.

Context

The v0.5.0 report found that CI runs go vet, go test ./..., Linux binary build, Docker build, Docker publish, and release artifact attestations. A lightweight dependency vulnerability check and optional coverage signal would improve release review confidence without changing application behavior.

Proposed change

Evaluate adding govulncheck to CI and a minimal coverage reporting step. Keep any new checks narrow and review whether coverage is advisory or required before making it a branch-protection requirement.

Acceptance criteria

• CI runs an explicit Go vulnerability scan, or the repository documents why this remains manual.
• CI records a coverage signal, or the repository documents why coverage remains manual.
• New checks do not require secrets for pull requests from forks.
• Branch protection documentation is updated only if a new check becomes required.
• Release documentation distinguishes vulnerability and coverage signals from production-readiness guarantees.

Tests / validation

• Inspect .github/workflows/ci.yml.
• Confirm pull request CI still runs successfully.
• Confirm any new workflow permissions remain least-privilege.
• Confirm no application behavior changes are included.

Out of scope

• Do not change backend routes, storage behavior, encryption, key custody, or deployment assumptions.
• Do not make coverage percentage a hard merge gate without an explicit maintainer policy decision.
• Do not add unrelated CI providers or cloud services.
• Do not claim that vulnerability scanning proves the release is vulnerability-free.

Notes

• Report finding ID: SR-TR-005-001
• Original draft directory: .backlog-drafts/2026-05-26/add-technical-review-for-v0.5.0/

[TheSilkky]

Closed by #55